WordPress Events Made Easy plugin <= 2.2.80 - Unauthenticated SQL Injection (SQLi) vulnerability

Unauthenticated SQL Injection SQLi vulnerability discovered by cydave in WordPress Events Made Easy plugin versions = 2.2.80. Solution Update the WordPress Events Made Easy plugin to the latest available version at least 2.2.81...

PT-2022-13855

Name of the Vulnerable Software and Affected Versions The Easy FAQ with Expanding Text WordPress plugin versions 3.2.8.3.1 and earlier Description The issue allows high privilege users to perform Cross-Site Scripting attacks when unfiltered html is disallowed, due to the plugin not sanitising and...

Events Made Easy < 2.2.81 - Unauthenticated SQLi

The plugin does not properly sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection PoC Obtain a valid nonce visit the "Events" page, default is /events/, and extract it from the source while looking for...

CVE-2022-1395: Improper Neutralization of Input During Web Page Generation

The Easy FAQ with Expanding Text WordPress plugin through 3.2.8.3.1 does not sanitise and escape its settings, allowing high privilege users to perform Cross-Site Scripting attacks when unfilteredhtml is disallowed...

WordPress plugin Easy FAQ with Expanding Text 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation. WordPress is a blogging platform developed using the PHP language. WordPress plugin is an application plugin. WordPress Easy FAQ with Expanding Text plugin 3.2.8.3.1 and earlier versions contain a cross-site scripting...

Easy Pricing Tables < 3.1.3 - Author+ Stored Cross-Site Scripting

The plugin does not sanitise and escape some parameters, which could allow users with a role as low as author to perform Stored Cross-Site Scripting attacks...

EC-CUBE Easy Blog for EC-CUBE4 Cross-Site Request Forgery Vulnerability

EC-CUBE Easy Blog for EC-CUBE4 is a component of the content management system from EC-CUBE Japan. EC-CUBE Easy Blog for EC-CUBE4 1.0.1 and earlier versions are vulnerable to cross-site request forgery, which stems from insufficient authentication of the source of HTTP requests. A remote,...

JVN#46241173: EC-CUBE plugin "Easy Blog for EC-CUBE4" vulnerable to cross-site request forgery

EC-CUBE plugin "Easy Blog for EC-CUBE4" provided by COREMOBILE Co. Ltd. contains a cross-site request forgery vulnerability CWE-352. Impact If a site administrator who is logging in to the management screen of EC-CUBE on which the plug-in is installed accesses a specially crafted page, a blog...

Privilege escalation in easyappointments

The Easy!Appointments API authorization is checked against the user's existence, without validating the permissions. As a result, a low privileged user eg. provider can create a new admin user via the "/api/v1/admins/" endpoint and take over the system. A patch is available on the develop branch ...

GHSA-7F62-4887-CFV5 Privilege escalation in easyappointments

The Easy!Appointments API authorization is checked against the user's existence, without validating the permissions. As a result, a low privileged user eg. provider can create a new admin user via the "/api/v1/admins/" endpoint and take over the system. A patch is available on the develop branch ...

Easy!Appointments 安全漏洞

Easy!Appointments is a web-based appointment and schedule management system. A security vulnerability exists in versions prior to Easy!Appointments 1.5.0. An attacker exploited the vulnerability to cause an API privilege escalation...

[SECURITY] Fedora 36 Update: python-fastapi-0.75.2-1.fc36

FastAPI is a modern, fast high-performance, web framework for building APIs with Python 3.6+ based on standard Python type hints. The key features are: =EF=BF=BD=EF=BF=BD=EF=BF=BD Fast: Very high performance, on par with NodeJS and Go thanks to Starlette and Pydantic. One of the fastest Python...

[SECURITY] Fedora 34 Update: golang-github-oklog-0.3.2-9.20190701gitca7cdf5.fc34

OK Log is a distributed and coordination-free log management system for big o l' clusters. It's an on-prem solution that's designed to be a sort of building block: easy to understand, easy to operate, and easy to extend...

WordPress Plugin Easy Google Maps Cross-Site Scripting Vulnerability

WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL. A cross-site scripting vulnerability exists in the version of WordPress plugin Easy Google Maps before 1.9.32, which can be exploited by attackers...

CVE-2021-46780

The Easy Google Maps WordPress plugin before 1.9.32 does not escape the tab parameter before outputting it back in an attribute in the admin dashboard, leading to a Reflected Cross-Site Scripting...

CVE-2021-46780

The Easy Google Maps WordPress plugin before 1.9.32 does not escape the tab parameter before outputting it back in an attribute in the admin dashboard, leading to a Reflected Cross-Site Scripting...

Cross site scripting

The Easy Google Maps WordPress plugin before 1.9.32 does not escape the tab parameter before outputting it back in an attribute in the admin dashboard, leading to a Reflected Cross-Site Scripting...

CVE-2021-46780

The vulnerability CVE-2021-46780 affects the WordPress plugin Easy Google Maps (before 1.9.32). The issue is a Reflected Cross-Site Scripting (XSS) in the admin dashboard where the tab parameter is not escaped before output in an attribute, enabling injected script in some contexts. Mitigation: u...

PT-2022-12916

Name of the Vulnerable Software and Affected Versions Easy Google Maps WordPress plugin versions prior to 1.9.32 Description The issue is related to a Reflected Cross-Site Scripting problem. It occurs because the tab parameter is not properly escaped before being outputted back in an attribute in...

WordPress plugin Easy Google Maps 跨站脚本漏洞

WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL. A cross-site scripting vulnerability exists in the version of WordPress plugin Easy Google Maps before 1.9.32, which can be exploited by attackers...